Privacy policy

What SirTripsALot holds about you

• Your account. The email address you sign in with. With an emailed link or a passkey there is no password at all; a password, if you set one, is kept by the sign-in service only as a one-way hash, and nobody can read it back.

• Your trips and bookings. Flights, stays, activities, confirmation codes, seats, the names of the travelers on a booking, prices and points, and anything you type into a booking or a debrief. These are the point of the app.

• Booking emails, if you connect a mailbox. With your permission SirTripsALot reads your Gmail or Outlook mailbox for booking confirmations. It doesn’t keep the rest of your mail, and it stops reading the moment you disconnect the mailbox. If you forward an email to your SirTripsALot address instead, only that email is read.

  For each email it acted on, it keeps the first 2,000 characters so you can see why, along with any ticket or receipt attached to it, filed as a document on the trip.

  When it reads an email and doesn’t add it, because it isn’t travel, repeats a booking you already have, is a cancellation, or is one you dismissed before, it keeps the sender, the subject, when it arrived, what it read and the first 2,000 characters, so you can see why it was left out and add it anyway. It keeps the same when it tried to read an email and couldn’t. For an email from a sender you’ve marked as not travel, one it has already handled, or one your mailbox wouldn’t hand over, it keeps only the sender, the subject, and when it arrived. An email with no booking details in it, or one from another trip tracker, leaves no record. After 90 days each of these records is cleared down to your mailbox’s id for the message, which says nothing about the email and only tells SirTripsALot it has already looked.

  Separately, for emails turned away by their subject line alone, it keeps a short list so you can add one yourself: the sender, the subject, when it arrived, and your mailbox’s id for the message. This list doesn’t keep any email’s text or attachments. Only the most recent 25 per mailbox are kept, and older ones drop off. When you tap Add it, SirTripsALot fetches that one email from your mailbox again and reads it like any other booking email, so if it still isn’t added, it gets the record described above.

  Disconnecting a mailbox deletes its short list and your “Not a booking” answers for it. It doesn’t clear the other records above; deleting your account does.

• Documents you upload. Tickets, receipts, visas, and, in the vault, your passport, arrival form confirmations, and their photos. A visa’s or an arrival form’s country and dates are compared with your trips on your own trip pages, and nowhere else. They are stored privately, in your own folder, and shown only to you through links that expire after two minutes. On the phone, opening one asks for Face ID or Touch ID; the check happens on the device and never reaches us.

• Where you are, while the app is open. Only if you allow it: to say how far you are from your next stop, and to suggest the local currency in the currency converter. Your location is used on the phone, never sent to SirTripsALot, and not stored.

• A notification token. If you allow notifications, the phone gives us a token so we can tell you when an airline changes a flight. Nothing else is sent through it. While a flight is on your Lock Screen, the phone gives us a second token for that display alone, so its gate and times can be updated there; we delete it when the flight is over.

• Citizenship. Which countries you’re a citizen of, if you add them or a passport you saved shows it. It’s used only to decide which travel limits apply to you, such as the 90 days in Europe that EU, EEA, and Swiss citizens don’t have.

• Home airport, timezone, and currency. Set by you, or inferred from your flights and shown to you as such.

• Copies on your phone and in your browser. So your trips open without a connection, the iPhone app keeps a copy of your itineraries, and of any documents you download, on the phone. Signing out of the app deletes them. On the web, a trip you save for offline is kept in that browser until you remove it from the trip’s page.

What it does with that

Builds your itinerary, counts your days in Europe against the 90-in-180 rule, counts the countries you have been to, converts expenses, works out what your points bought, and checks your passport’s expiry against your booked trips. Every calculation runs for you and is shown to you. Nothing is sold, nothing is used for advertising, and nothing is used to train anything.

Who else sees it

• The services that run SirTripsALot. Supabase stores the data and handles sign-in, and Vercel runs the site. Postmark sends SirTripsALot’s emails and receives the bookings you forward. Cloudflare runs the domain’s addresses and email routing, and stores SirTripsALot’s encrypted nightly backups; GitHub runs that backup, making the copy of the database before it is encrypted. Expo passes the iPhone app’s notifications on to Apple to deliver, and SirTripsALot sends the flight on your Lock Screen to Apple directly: its flight number, airports, times, gate, and status. Each holds what it needs on SirTripsALot’s behalf and under its instructions.

• Parsing. The text of a booking confirmation — one you paste, one you forward, or one SirTripsALot finds in a connected mailbox — is sent to an AI model (Anthropic’s Claude) to be turned into a structured booking. Only that email goes, never the rest of your mailbox, and Anthropic may not use it to train its models. A file you share to SirTripsALot is checked on SirTripsALot’s own server first: if it looks like one of your travel documents (a passport, visa, arrival form, or similar), it isn’t sent to an AI model at all. A receipt you scan into an expense is sent as a photo or PDF to the same AI model to read its total, currency, date, and the business’s name. When you scan a receipt, we read it and then delete it, unless you choose to keep it with the expense. A kept receipt is stored with your trip’s documents, and deleting the expense deletes it. A screenshot of a booking that you share or upload is read for its words: on the iPhone they’re read on the phone itself, and only the words are sent to be read; uploaded on the web, or when the phone can’t read it, the picture is sent to the same AI model to write out its words. The words are then read like any booking you paste. Either way, a small copy of the picture is saved with the booking it adds, as one of its documents.

• Rates, weather, maps, and flights. Exchange rates come from SirTripsALot’s server, which asks free public rate services for them. Those requests carry only a currency and a date, nothing about you or your trip. Weather comes from Open-Meteo, place search from Google, a trip’s cover photo sometimes from Wikimedia, and flight status from an aviation data provider; SirTripsALot’s server asks them, and the request carries the place, the words you searched, or the flight number, never your name or account. Maps are different: they load straight from Mapbox or OpenStreetMap on the web, and Apple Maps on the iPhone, so those services see your network address and the area the map shows. What the flight provider tells us (gates, terminals, delays, baggage belts) is cleared from your booking about a week after the flight; what your own confirmation said stays.

• People you share with. If you share a trip by link, anyone holding the link sees the itinerary: what, when, and where. Prices, booking references, other travelers, and documents are not included. You can replace or stop the link at any time.

• Your calendar, if you subscribe. Your trips’ calendar feed includes each booking’s times, places, and confirmation code. The calendar app you subscribe with keeps its own copy. Replacing the feed’s link in Settings stops new updates, but doesn’t remove what a calendar already holds.

• AI assistants you connect. If you connect an AI assistant such as Claude or ChatGPT to SirTripsALot, it can read your trips, bookings, spending, and countries when you ask it to. It can’t change anything, and it can’t see your travel documents, other travelers on a booking, or your emails. A booking SirTripsALot filed from a connected mailbox is shared like any other booking — its dates, places, confirmation code, and price — but never the email it came from or its attachments; you choose this when you allow the assistant. What it does with what it reads is governed by that assistant’s own terms. You can disconnect it at any time in Settings → Connections.

• Your mailbox provider. Connecting Gmail or Outlook goes through Google’s or Microsoft’s own consent screen, and you can revoke it there as well as in SirTripsALot.

Nobody else. There are no advertisers and no data brokers, and nothing follows you across other apps or sites.

Mail from Google and Microsoft

SirTripsALot’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The same rules apply to mail read from Microsoft Outlook.

• Mail is read with read-only access, only to find and file your bookings, and only for you.
• It is never sold, never used for advertising, and never used to train AI models, ours or anyone else’s.
• It is shared only with the services named above, and only to do that job: the parsing model reads a booking email to file it, and the storage provider holds what was filed.
• Nobody at SirTripsALot reads your mail. The only exceptions are when you ask us to look at a specific email to fix a problem, when it is needed for security, or when the law requires it.
• Disconnecting a mailbox in SirTripsALot’s Inbox deletes its access tokens and asks Google to revoke SirTripsALot’s access. You can also remove it from your Google account or your Microsoft account.

How your data is protected

What SirTripsALot holds from your mailbox, your bookings, and your documents is protected in these ways:

• Encrypted in transit. Everything between your browser or phone, SirTripsALot’s servers, its storage provider, and Google or Microsoft travels over HTTPS (TLS).

• Encrypted on the servers. The storage provider encrypts the database and stored files on its disks. The keys that let SirTripsALot read your mailbox (OAuth tokens) are also encrypted by SirTripsALot itself with AES-256-GCM, under a key held only on its servers, so the stored tokens are useless to anyone who reads the database without it.

• Only you can reach your data. Every row is tied to your account, and the database itself refuses any other account’s request for it (row-level security). SirTripsALot’s own server reaches it only to do the work described on this page. Your documents are in private storage, and each view is a link that expires after two minutes.

• The least access needed. Mail is read with read-only access. SirTripsALot keeps what it filed and the short excerpts described above, not your mailbox, and clears its record of emails it didn’t add after 90 days.

• Limited people. Only the people at M Ho Studios LLC who run SirTripsALot can reach the systems that hold your data, under the rules in “Mail from Google and Microsoft” above.

• On the phone. Your travel documents open only after Face ID or your passcode. That’s a lock on opening them in the app, not separate encryption: the copies kept on the phone are protected by the phone’s own security, and a file you save or share out of the app is yours to look after.

How long it is kept

For as long as you have an account. Delete a booking, a document, or a trip and it is gone from your account then; disconnect a mailbox and its sync tokens are deleted then. The one thing kept for less time is the record of emails SirTripsALot looked at and didn’t add: after 90 days only the message’s id is left. SirTripsALot keeps its own nightly backup of the database, encrypted, and deletes each one after 30 days; the files you upload aren’t in it.

Deleting your account

You can delete your account yourself, inside the app: on the web under Settings → Account, on the phone at the bottom of Settings. Deleting removes your account, every trip and booking, every expense, every connected mailbox, and every file you uploaded, at once and permanently. If a file can’t be removed right away, a daily job keeps trying until it is. There is no waiting period and nothing to email us for. Two things last a little longer: the encrypted nightly backups, each deleted after 30 days, and, if we delete an account for you, a note in our own admin log that we did, whose email address is cleared after 90 days.

Updates list

If you sign up for updates, SirTripsALot keeps your email address and when you confirmed it, and uses it only to tell you about SirTripsALot’s availability and news. Every email from the list has an unsubscribe link. Unsubscribing stops them and deletes your answers below; your address stays, marked unsubscribed, so it isn’t emailed again. An address that is never confirmed is deleted after 30 days. To limit sign-ups from any one network, it also keeps a one-way code made from the network address and browser a sign-up came from, never the address itself. Signing up is not an account and does not give access to SirTripsALot.

If you also answer “How do you travel?”, SirTripsALot keeps those answers with your email: your phone, where your booking emails arrive, how and how often you travel, your home country, how you organize your travel plans now, how important each feature is to you, and anything you write in the last box. Every question is optional. They’re used only to choose who tries SirTripsALot first and what to build next, are read by SirTripsALot alone, and are deleted when you unsubscribe.

Your choices

• Location, notifications, camera, and photos are each a permission the phone asks for, and each can be refused or withdrawn in the phone’s Settings without losing anything else.
• Face ID for the vault and for the app itself are switches in Privacy, on the phone.
• A connected mailbox can be disconnected from the Inbox at any time, on the web or the phone.

Children

SirTripsALot is not for children under 13 and does not knowingly hold their data.

Changes

When this page changes, the date at the top changes with it. Anything that widens what is collected will be said on the sign-in page before it takes effect.